POET is a simple post-exploitation tool to gain a remote shell on target machine.

The client program runs on the target machine and is configured with an IP address (the server) to connect to and a frequency to connect at. If the server isn’t running when the client tries to connect, the client quietly sleeps and tries again at the next interval. If the server is running however, the attacker gets a control shell to control the client and perform various actions on the target including:

reconnaissance

remote shell

file exfiltration

download and execute

self-destruct

Example:

The scenario is, an attacker has gotten access to the victim’s machine and downloaded and executed the client. She does not have the server running at this point, but it’s ok, the client waits patiently. Eventually, the attacker is ready and starts the server, first starting a shell and executing uname -a, then exfiltrating /etc/passwd. Then she exits and detaches from the client, which continues running on the target waiting for the next opportunity to connect to the server. Later, she connects again, self-destructing the client, removing all traces from the target.

Usage:

Poet is super easy to use, and requires nothing more than the Python (2.7) standard library. To easily test it out, a typical invocation would look like:Terminal 1:

$ ./poet-client 127.0.0.1 1 --debug --no-selfdestruct

By default, the Poet client daemonizes and deletes itself from disk, so that behavior is suppressed using the –debug and –no-selfdestruct flags.

Terminal 2:

$ sudo ./poet-server

By default, the server needs to be run as root (using sudo) because the default port it binds to is 443. If that makes you uncomfortable, simply omit sudo and use the -p <PORT> flag on both the client and server. Pick a nice, high number for your port (> 1024).

Poet is a client/server application. The client is executed on the target and beacons back to the server at a certain time interval. The only required argument is the IP address where the server is or will be running. Following it can optionally be the time interval in seconds of how frequently to beacon back, which defaults to 10 minutes. The port for the client to beacon out on can be specified with the -p flag. All other flags would not be used during “real” usage and exist mainly for debugging.